openclaw-shield

Solid

Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw setup.

Code & Development 81 stars 18 forks Updated today MIT

Install

View on GitHub

Quality Score: 89/100

Stars 20%
64
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# OpenClaw Shield — Security Audit Audit any OpenClaw config for security vulnerabilities, misconfigurations, and best-practice violations. Produces a structured JSON report with risk scores, findings, and remediation steps. ## When to Use - User asks to check/audit/review their OpenClaw security - User wants to harden their config before deploying - User is setting up a new OpenClaw instance - User asks about secret leakage or API key exposure in their config - Before publishing or sharing any config file ## Quick Audit (live config) ```bash node scripts/shield-audit.sh ``` Or directly: ```bash node SKILL_DIR/bin/shield.js audit ~/.openclaw/openclaw.json --summary ``` ## What It Checks (11 categories) 1. **Gateway Auth** — missing/weak auth, insecure UI settings 2. **Network Exposure** — bind address, Tailscale funnel, wildcard proxies 3. **Channel Security** — wildcard allowFrom, missing allowlists 4. **DM Policy** — open DM policy without pairing 5. **Subagent Permissions** — wildcard allowAgents, circular delegation chains, self-delegation 6. **Tool Permissions** — over-privileged agents with tools.profile: "full" 7. **Secret Leakage** — API keys, tokens, private keys in plaintext config 8. **Sandbox/Execution** — missing workspace isolation, no execution policies 9. **Plugin Config** — enabled plugins without channel config 10. **Heartbeat Exposure** — sensitive data in heartbeat prompts 11. **Remote Config** — unencrypted WebSocket, exposed remote URLs/tokens ...

Details

Author
aAAaqwq
Repository
aAAaqwq/AGI-Super-Team
Created
6 months ago
Last Updated
today
Language
Python
License
MIT

Integrates with

WebSocket · API

Bundled in these plugins

agi-super-team

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Solid

security-agent

Comprehensive OpenClaw security assessment, hardening, and monitoring agent. Covers 7 domains — gateway hardening, channel/sender policy, tool/exec policy, credential hygiene, prompt injection defense, host OS hardening, and continuous monitoring. Use when asked to audit security, harden the setup, check for exposed secrets, assess threat model, schedule security monitoring, respond to potential compromise, fix security audit findings, or review OpenClaw config safety. Triggers on phrases like "security audit", "harden my setup", "check my security", "exposed secrets", "am I secure", "security agent", "threat model", "I think I'm compromised", "fix security warnings", "security posture".

36 Updated today
OpenCoven
AI & Automation Listed

security-audit

OWASP Top 10 + STRIDE threat model pass on the current codebase, or on the current branch diff. Emits a findings report with severity, confidence, and exploit scenario. Use alongside Claude Code's built-in /security-review for spot checks, and whenever the diff touches auth, credentials, tool policy, shell execution, or data persistence. Adapted from Garry Tan's gstack /cso (garrytan/gstack); role framing stripped.

2 Updated 2 days ago
RobertIlisei
AI & Automation Listed

openclawtrack

OpenClaw Command Center — Full infrastructure scan with visual dashboard. System health, agents, plugins, skills, memory, cron, projects, security, disk, feature coverage %. Generates OPENCLAW_DASHBOARD.md

1 Updated yesterday
durang